crash / 5.3.1 / functions array acces

crash / 5.3.1 / functions array acces

[Phil Pennock]

[-- Attachment #1: Type: text/plain, Size: 2829 bytes --]

Reported to me by Benjamin R. Haskell via a local community Slack:

  functions+=( $'a\000\nb' 'echo crazy chars' )

Run that twice.

Zsh 5.3.1 on macOS crashes, stack-trace:

(lldb) bt
* thread #1: tid = 0x0000, 0x0000000105ace0a0 parameter.so`___lldb_unnamed_symbol64$$parameter.so + 56, stop reason = signal SIGSTOP
  * frame #0: 0x0000000105ace0a0 parameter.so`___lldb_unnamed_symbol64$$parameter.so + 56
    frame #1: 0x00000001059ce4ce zsh`arrhashsetfn + 462
    frame #2: 0x00000001059ceb75 zsh`assignaparam + 948
    frame #3: 0x000000010599ccdd zsh`___lldb_unnamed_symbol25$$zsh + 830
    frame #4: 0x000000010599ef22 zsh`___lldb_unnamed_symbol36$$zsh + 4233
    frame #5: 0x000000010599daf8 zsh`___lldb_unnamed_symbol34$$zsh + 341
    frame #6: 0x0000000105999365 zsh`___lldb_unnamed_symbol19$$zsh + 637
    frame #7: 0x0000000105998b86 zsh`execlist + 1386
    frame #8: 0x00000001059985fa zsh`execode + 196
    frame #9: 0x00000001059b1f59 zsh`loop + 800
    frame #10: 0x00000001059b4c9a zsh`zsh_main + 1434
    frame #11: 0x00007fffab7b5255 libdyld.dylib`start + 1
    frame #12: 0x00007fffab7b5255 libdyld.dylib`start + 1

Then I checked to see if I could reproduce with something simpler as the
key:

  % functions+=( a 'echo woot' )
  % functions+=( a 'echo woot' )
zsh(2741,0x7fffb46023c0) malloc: *** error for object 0x6000000000000000: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug
zsh: abort (core dumped)  zsh

(lldb) bt
* thread #1: tid = 0x0000, 0x00007fffab8e3dd6 libsystem_kernel.dylib`__pthread_kill + 10, stop reason = signal SIGSTOP
  * frame #0: 0x00007fffab8e3dd6 libsystem_kernel.dylib`__pthread_kill + 10
    frame #1: 0x00007fffab9cf787 libsystem_pthread.dylib`pthread_kill + 90
    frame #2: 0x00007fffab849420 libsystem_c.dylib`abort + 129
    frame #3: 0x00007fffab93903f libsystem_malloc.dylib`free + 530
    frame #4: 0x000000010a87bbab zsh`deletehashtable + 26
    frame #5: 0x000000010a89b4ae zsh`deleteparamtable + 27
    frame #6: 0x000000010a9a0110 parameter.so`___lldb_unnamed_symbol64$$parameter.so + 168
    frame #7: 0x000000010a8a04ce zsh`arrhashsetfn + 462
    frame #8: 0x000000010a8a0b75 zsh`assignaparam + 948
    frame #9: 0x000000010a86ecdd zsh`___lldb_unnamed_symbol25$$zsh + 830
    frame #10: 0x000000010a870f22 zsh`___lldb_unnamed_symbol36$$zsh + 4233
    frame #11: 0x000000010a86faf8 zsh`___lldb_unnamed_symbol34$$zsh + 341
    frame #12: 0x000000010a86b365 zsh`___lldb_unnamed_symbol19$$zsh + 637
    frame #13: 0x000000010a86ab86 zsh`execlist + 1386
    frame #14: 0x000000010a86a5fa zsh`execode + 196
    frame #15: 0x000000010a883f59 zsh`loop + 800
    frame #16: 0x000000010a886c9a zsh`zsh_main + 1434
    frame #17: 0x00007fffab7b5255 libdyld.dylib`start + 1
    frame #18: 0x00007fffab7b5255 libdyld.dylib`start + 1


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: crash / 5.3.1 / functions array acces

[Sebastian Gniazdowski]

Being irrationally haunted by the bold optimizations that I've
submitted.. Checked that this happens also on 5.1.1 and 5.0.2.

-- 
  Sebastian Gniazdowski

Re: crash / 5.3.1 / functions array acces

[Axel Beckert]

Hi,

On Mon, Feb 06, 2017 at 12:15:14PM -0800, Sebastian Gniazdowski wrote:
> Being irrationally haunted by the bold optimizations that I've
> submitted.. Checked that this happens also on 5.1.1 and 5.0.2.

I can reproduce this with 5.3.1 on x86_64 (Debian Unstable), too.

I can even reproduce this with zsh 5.0.7 in Debian 8 Jessie (x86_64).

And with zsh 4.3.17 from Debian 7 Wheezy (x86) it crashes already on
calling that the first time.

		Kind regards, Axel
-- 
/~\  Plain Text Ribbon Campaign                   | Axel Beckert
\ /  Say No to HTML in E-Mail and News            | abe@deuxchevaux.org  (Mail)
 X   See http://www.nonhtmlmail.org/campaign.html | abe@noone.org (Mail+Jabber)
/ \  I love long mails: http://email.is-not-s.ms/ | http://abe.noone.org/ (Web)

[PATCH] Make $functions re-settable.

[Daniel Shahaf]

---
Unlike the standard hash setter, setfunctions() wasn't checking that ht !=
pm->u.hash.  Rather than reimplement that, I chose (perhaps overzealously) to
delegate to the standard setter.

Cheers,

Daniel

 Src/Modules/parameter.c | 4 ++--
 Test/V06parameter.ztst  | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/Src/Modules/parameter.c b/Src/Modules/parameter.c
index 6e62287..c251e4f 100644
--- a/Src/Modules/parameter.c
+++ b/Src/Modules/parameter.c
@@ -330,7 +330,7 @@ unsetpmfunction(Param pm, UNUSED(int exp))
 
 /**/
 static void
-setfunctions(UNUSED(Param pm), HashTable ht, int dis)
+setfunctions(Param pm, HashTable ht, int dis)
 {
     int i;
     HashNode hn;
@@ -349,7 +349,7 @@ setfunctions(UNUSED(Param pm), HashTable ht, int dis)
 
 	    setfunction(hn->nam, ztrdup(getstrvalue(&v)), dis);
 	}
-    deleteparamtable(ht);
+    hashsetfn(pm, ht);
 }
 
 /**/
diff --git a/Test/V06parameter.ztst b/Test/V06parameter.ztst
index 10e0a27..27d5878 100644
--- a/Test/V06parameter.ztst
+++ b/Test/V06parameter.ztst
@@ -86,6 +86,12 @@
 >I have been autoloaded
 >$mydir/myfunc
 
+ functions+=(a 'echo foo'); a
+ functions+=(a 'echo bar'); a
+0:$functions can be appended to twice
+>foo
+>bar
+
 %clean
 
  rm -f autofn functrace.zsh rocky3.zsh sourcedfile myfunc